A packet capture shows repeated failed login attempts. What can it support?
Correct Answer: A. Network intrusion investigation
MCQ Collection
Digital Forensics MCQs
Digital Forensics MCQs for practice, quizzes, and exam preparation.
A forensic examiner is dealing with virtualization in forensics. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.
In digital forensics, what does ‘Data distribution analysis’ mainly refer to?
Correct Answer: A. Studying patterns, outliers, and frequency in forensic datasets.
An examiner notices system clocks differ by two hours. What should be considered?
Correct Answer: A. Time normalization for timeline analysis
A forensic examiner is dealing with audio/video evidence. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.
In digital forensics, what does ‘Forensic tool validation’ mainly refer to?
Correct Answer: A. Checking that a tool produces reliable and repeatable results.
Which option best describes the purpose of data distribution analysis in a forensic investigation?
Correct Answer: A. To support pattern interpretation during an investigation.
A hard drive image is analyzed instead of the original drive. Why?
Correct Answer: A. To preserve the original evidence
In digital forensics, what does ‘Image metadata’ mainly refer to?
Correct Answer: A. Embedded information in images such as date, device model, and gps when present.
Which option best describes the purpose of forensic tool validation in a forensic investigation?
Correct Answer: A. To support tool reliability assurance during an investigation.
A forensic examiner is dealing with data distribution analysis. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.
Which artifact is most useful for reconstructing Windows user activity?
Correct Answer: A. Registry and event logs